CVE-2026-109618 & CVE-2026-109619

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Russ
    Senior Member
    • Feb 2022
    • 531

    #1

    CVE-2026-109618 & CVE-2026-109619

    Hey guys, once php updated, can we expect that espocrm will work as is or should we take the systems offline for now?
    As you may know it's a major problem everywhere right now.
  • yuri
    EspoCRM product developer
    • Mar 2014
    • 10084

    #2
    Hi,

    While you are still on a not updated PHP, I'd suggest either shutting it down or applying mitigations described here https://www.php.net/archive/2026.php.

    Docker images are being built. The official Dockerhub not yet updated. Hope they will do it soon.

    Comment

    • SailReal
      Member
      • Jun 2025
      • 52

      #3
      Hi,

      Seems to be fixed, thanks for the super fast reaction!

      Comment

      • partomas
        Active Community Member
        • Sep 2018
        • 387

        #4
        Could you clarify which EspoCRM Docker image tags now include the PHP security fixes? Have images for older EspoCRM versions also been rebuilt, or only those for the latest release?

        Comment


        • SailReal
          SailReal commented
          Editing a comment
          On docker hub a lot of espo tags where rebuild. You can verify if the issue is fixed on your tag by pulling it and executing something like `docker compose exec espocrm php -v`. Then you can check the version against the patched one of https://www.php.net/index.php#2026-10-20-1 (8.5.12, 8.4.27, 8.3.36 and 8.2.35)
      • TKopp
        Junior Member
        • Apr 2025
        • 18

        #5
        Hey yuri, will there be an update for the older versions like 9.3.4? Unfortunately we are not able to upgrade to higher versions at the moment, which would mean for us we would have to shut espocrm down. Kind regards Til!

        Comment

        • yuri
          EspoCRM product developer
          • Mar 2014
          • 10084

          #6
          There will be 9.3 build too.

          Comment

          • Dave B
            Junior Member
            • Jul 2021
            • 15

            #7
            yuri Can you confirm that the SaaS platform that we use has been patched?

            Comment


            • yuri
              yuri commented
              Editing a comment
              Was patched as soon as the patch was released.
          Working...